chore(deps): update node.js to v20.19.0 #162
Loading…
x
Reference in New Issue
Block a user
No description provided.
Delete Branch "renovate/node-20.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
20.18.1-alpine->20.19.0-alpine20.18.1-alpine->20.19.0-alpineRelease Notes
nodejs/node (node)
v20.19.0: 2025-03-13, Version 20.19.0 'Iron' (LTS), @marco-ippolitoCompare Source
Notable Changes
require(esm) is now enabled by default
Support for loading native ES modules using require() had been available on v20.x under the command line flag --experimental-require-module, and available by default on v22.x and v23.x. In this release, it is now no longer behind a flag on v20.x.
This feature has been tested on v23.x and v22.x, and we are looking for user feedback from v20.x to make more final tweaks before fully stabilizing it.
It now no longer emits a warning unless
--trace-require-moduleis explicitly used.If there happens to be any regressions caused by this feature, users can report it to the Node.js issue tracker. Meanwhile this feature can also be disabled using
--no-experimental-require-moduleas a workaround.With this feature enabled, Node.js will no longer throw
ERR_REQUIRE_ESMifrequire()is used to load a ES module. It can, however, throwERR_REQUIRE_ASYNC_MODULEif the ES module being loaded or its dependencies contain top-levelawait. When the ES module is loaded successfully byrequire(), the returned object will either be a ES module namespace object similar to what's returned byimport(), or what gets exported as"module.exports"in the ES module.Users can check
process.features.require_moduleto see whetherrequire(esm)is enabled in the current Node.js instance. For packages, the"module-sync"exports condition can be used as a way to detectrequire(esm)support in the current Node.js instance and allow bothrequire()andimportto load the same native ES module. See the documentation for more details about this feature.Contributed by Joyee Cheung in #55085
Module syntax detection is now enabled by default
Module syntax detection (the
--experimental-detect-moduleflag) is nowenabled by default. Use
--no-experimental-detect-moduleto disable it ifneeded.
Syntax detection attempts to run ambiguous files as CommonJS, and if the module
fails to parse as CommonJS due to ES module syntax, Node.js tries again and runs
the file as an ES module.
Ambiguous files are those with a
.jsor no extension, where the nearest parentpackage.jsonhas no"type"field (either"type": "module"or"type": "commonjs").Syntax detection should have no performance impact on CommonJS modules, but it
incurs a slight performance penalty for ES modules; add
"type": "module"tothe nearest parent
package.jsonfile to eliminate the performance cost.A use case unlocked by this feature is the ability to use ES module syntax in
extensionless scripts with no nearby
package.json.Thanks to Geoffrey Booth for making this work on #53619.
Other Notable Changes
285bb4ee14] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #5656673b5c16684] - (SEMVER-MINOR) worker: add postMessageToThread (Paolo Insogna) #53682de313b2336] - (SEMVER-MINOR) module: only emit require(esm) warning under --trace-require-module (Joyee Cheung) #561944fba01911d] - (SEMVER-MINOR) process: add process.features.require_module (Joyee Cheung) #55241df8a045afe] - (SEMVER-MINOR) module: implement the "module-sync" exports condition (Joyee Cheung) #54648f9dc1eaef5] - (SEMVER-MINOR) module: add __esModule to require()'d ESM (Joyee Cheung) #52166Commits
d84be843e3] - benchmark: add validateStream to styleText bench (Rafael Gonzaga) #56556d8eaf5b9b8] - build: fix compatibility with V8'sdepot_tools(Richard Lau) #573301ee4bf9690] - build: test macos-13 on GitHub actions (Michaël Zasso) #563071cc8d69882] - build: build v8 with -fvisibility=hidden on macOS (Joyee Cheung) #5627552f1f7e22b] - child_process: fix parsing messages with splitted length field (Maksim Gorkov) #561065ef3c3c996] - crypto: add missing return value check (Michael Dawson) #56615285bb4ee14] - crypto: update root certificates to NSS 3.107 (Node.js GitHub Bot) #5656646ceb9dc1c] - deps: update timezone to 2025a (Node.js GitHub Bot) #56876d4ca38fe8e] - deps: macro ENODATA is deprecated in libc++ (Cheng) #5669815214e6508] - deps: update simdutf to 6.0.3 (Node.js GitHub Bot) #565671e44f5d84b] - deps: update simdutf to 5.7.2 (Node.js GitHub Bot) #56388b92ff7be38] - deps: update googletest to7d76a23(Node.js GitHub Bot) #56387e1b71a81a9] - deps: update googletest toe54519b(Node.js GitHub Bot) #56370c0d45e7f38] - deps: update simdutf to 5.7.0 (Node.js GitHub Bot) #56332d69107f5a8] - deps: update icu to 76.1 (Node.js GitHub Bot) #555515c9a397699] - deps: V8: backport9ab4059(Lu Yahan) #567818342233f6d] - deps: update corepack to 0.31.0 (Node.js GitHub Bot) #56795561493d35e] - deps,src: simplify base64 encoding (Daniel Lemire) #527146207b2936c] - doc: move anatoli to emeritus (Michael Dawson) #56592b0ab483400] - doc: fix styles of the expandable TOC (Antoine du Hamel) #5675553e4dc2a82] - doc: add "Skip to content" button (Antoine du Hamel) #5675033ee4645c3] - doc: improve accessibility of expandable lists (Antoine du Hamel) #56749b514438418] - doc: add note regarding commit message trailers (Dario Piotrowicz) #56736627f2997e3] - doc: fix typo in example code for util.styleText (Robin Mehner) #5672068548dcb48] - doc: fix inconsistencies inWeakSetandWeakMapcomparison details (Shreyans Pathak) #56683337cfb2549] - doc: add RafaelGSS as latest sec release stewards (Rafael Gonzaga) #56682e890c86d7b] - doc: clarify cjs/esm diff inqueueMicrotask()vsprocess.nextTick()(Dario Piotrowicz) #56659978263923f] - doc:WeakSetandWeakMapcomparison details (Shreyans Pathak) #56648aba280ccd8] - doc: mention prepare --security (Rafael Gonzaga) #566170a009a527b] - doc: tweak info on reposts in ambassador program (Michael Dawson) #56589d2f09e2ab3] - doc: add type stripping to ambassadors program (Marco Ippolito) #56598b0b77d7fbe] - doc: improve internal documentation on built-in snapshot (Joyee Cheung) #565054b3e7fee94] - doc: document CLI way to open the nodejs/bluesky PR (Antoine du Hamel) #5650603878b0384] - doc: update gcc-version for ubuntu-lts (Kunal Kumar) #56553acbbd7c1a6] - doc: fix parentheses in options (Tobias Nießen) #565633fe80c30b8] - doc: include CVE to EOL lines as sec release process (Rafael Gonzaga) #56520ff8af58046] - doc: add esm examples to node:trace_events (Alfredo González) #5651427b9cfd135] - doc: add message for Ambassadors to promote (Michael Dawson) #56235020c939da1] - doc: allow request for TSC reviews via the GitHub UI (Antoine du Hamel) #564931ef9c9a354] - doc: add example for piping ReadableStream (Gabriel Schulhof) #56415e675c3a7fc] - doc: expand description ofparseArg'sdefault(Kevin Gibbons) #54431bc756da876] - doc: use<ul>instead of<ol>inSECURITY.md(Antoine du Hamel) #56346ad59c82a49] - doc: clarify that WASM is trusted (Matteo Collina) #563458e76cc69e5] - doc: move dual package shipping docs to separate repo (Joyee Cheung) #554449fda8e29cd] - doc: mark--env-file-if-existsflag as experimental (Juan José) #568939e975f1a7d] - doc: fix link and history ofSourceMapsections (Antoine du Hamel) #5709864ce95b8fc] - doc: updaterequire(ESM)history and stability status (Antoine du Hamel) #55199697a39248b] - doc: fix history ofprocess.features(Antoine du Hamel) #548977c38e503a3] - doc: add documentation for process.features (Marco Ippolito) #54897c85b386a39] - esm: fix jsdoc type refs toModuleJobBasein esm/loader (Jacob Smith) #564994813a6a66c] - esm: throwERR_REQUIRE_ESMinstead ofERR_INTERNAL_ASSERTION(Antoine du Hamel) #548680d327c8e47] - esm: refactorget_format(Antoine du Hamel) #53872e87db6c9bc] - events: add hasEventListener util for validate (Sunghoon) #55230674b932f33] - http: don't emit error after destroy (Robert Nagy) #554574c24ef8f71] - http2: omit server name when HTTP2 host is IP address (islandryu) #56530533afe8124] - lib: reduce amount of caught URL errors (Yagiz Nizipli) #5265834221a1d6e] - lib: allow CJS source map cache to be reclaimed (Chengzhong Wu) #51711f13589f1f9] - lib,src: iterate module requests of a module wrap in JS (Chengzhong Wu) #520586afee9ea43] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #5658085bb738739] - meta: add codeowners of security release document (Rafael Gonzaga) #5652148f9ca0992] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #563424d724121b4] - meta: move MoLow to TSC regular member (Moshe Atlow) #562765e2dab7868] - module: fix badrequire.resolvewith option paths for.and..(Dario Piotrowicz) #56735f507c05060] - module: simplify --inspect-brk handling (Joyee Cheung) #55679ed2d373e5a] - module: disable require(esm) for policy and network import (Joyee Cheung) #56927de313b2336] - (SEMVER-MINOR) module: only emit require(esm) warning under --trace-require-module (Joyee Cheung) #561943d89e6b6fa] - module: mark evaluation rejection in require(esm) as handled (Joyee Cheung) #56122e01dd4bd4f] - module: do not warn when require(esm) comes from node_modules (Joyee Cheung) #55960011e6e0032] - module: fix error thrown from require(esm) hitting TLA repeatedly (Joyee Cheung) #55520fdf50289c6] - module: trim off internal stack frames for require(esm) warnings (Joyee Cheung) #554968d33f78ca5] - module: allow ESM that failed to be required to be re-imported (Joyee Cheung) #555028192dd6cf3] - module: include module information in require(esm) warning (Joyee Cheung) #553971db210a0ec] - module: check --experimental-require-module separately from detection (Joyee Cheung) #55250cf8701c866] - module: use kNodeModulesRE to detect node_modules (Joyee Cheung) #55243dc66632261] - module: support 'module.exports' interop export in require(esm) (Guy Bedford) #545631ac1dda9a4] - (SEMVER-MINOR) module: unflag --experimental-require-module (Joyee Cheung) #55085683c93f45f] - module: refator ESM loader for adding future synchronous hooks (Joyee Cheung) #54769df8a045afe] - (SEMVER-MINOR) module: implement the "module-sync" exports condition (Joyee Cheung) #54648249d82b686] - module: report unfinished TLA in ambiguous modules (Antoine du Hamel) #549801925d729f9] - module: remove bogus assertion in CJS entrypoint handling with --import (Joyee Cheung) #54592d1331fccb2] - module: do not warn for typeless package.json when there isn't one (Joyee Cheung) #540459916458b44] - (SEMVER-MINOR) module: unflag detect-module (Geoffrey Booth) #53619f9dc1eaef5] - (SEMVER-MINOR) module: add __esModule to require()'d ESM (Joyee Cheung) #52166b86f575504] - module: do not set CJS variables for Worker eval (Antoine du Hamel) #5305030ed93db12] - module: cache synchronous module jobs before linking (Joyee Cheung) #52868a03faf289d] - module: support ESM detection in the CJS loader (Joyee Cheung) #52047b07ad39bda] - module: detect ESM syntax by trying to recompile as SourceTextModule (Joyee Cheung) #52413132a5c190f] - module: eliminate performance cost of detection for cjs entry (Geoffrey Booth) #5209355a57a189f] - node-api: remove deprecated attribute from napi_module_register (Vladimir Morozov) #561624fba01911d] - (SEMVER-MINOR) process: add process.features.require_module (Joyee Cheung) #55241c0fad18ac0] - src: add nullptr handling from X509_STORE_new() (Burkov Egor) #567005b88d48cbb] - src: add default value for RSACipherConfig mode field (Burkov Egor) #56701e3b69e57a6] - src: fix build with GCC 15 (tjuhaszrh) #56740a7c1d8c0e8] - src: initialize FSReqWrapSync in path that uses it (Michaël Zasso) #56613c06ac66356] - src: fix undefined script name in error source (Chengzhong Wu) #56502500f3ccc66] - src: lock the thread properly in snapshot builder (Joyee Cheung) #56327cf25a5edeb] - src: drain platform tasks before creating startup snapshot (Chengzhong Wu) #564038af1b53bb8] - src: safely remove the last line from dotenv (Shima Ryuhei) #55982bb57e909aa] - src: removebase64fromprocess.versions(Richard Lau) #53442b8c89a693e] - src: add--env-file-if-existsflag (Bosco Domingo) #530609097de073a] - src: don't match after--inDotenv::GetPathFromArgs(Aviv Keller) #54237ececd225b6] - src: implement IsInsideNodeModules() in C++ (Joyee Cheung) #5528618593b7d3e] - src: refactor embedded entrypoint loading (Joyee Cheung) #53573d7aefc0524] - stream: fix typo in ReadableStreamBYOBReader.readIntoRequests (Mattias Buelens) #56560fe5f7bcd47] - stream: validate undefined sizeAlgorithm in WritableStream (Jason Zhang) #5606712744c1fd4] - test: reduce number of written chunks (Luigi Pinca) #56757e121d7d62c] - test: fix invalid common.mustSucceed() usage (Luigi Pinca) #5675611b82de7ed] - test: use strict mode in global setters test (Rich Trott) #56742f9d6e35c5e] - test: cleanup and simplify test-crypto-aes-wrap (James M Snell) #56748792ce98699] - test: do not use common.isMainThread (Luigi Pinca) #567684f0cf475e0] - test: add test that uses multibyte for path and resolves modules (yamachu) #566963bc8d273c2] - test: add missing test for env file (Jonas) #56642ad39367712] - test: enforce strict mode in test-zlib-const (Rich Trott) #56689ca79914137] - test: test-stream-compose.js doesn't need internals (Meghan Denny) #5661908bde67101] - test: add maxCount and gcOptions to gcUntil() (Joyee Cheung) #5652240a0f6f6e3] - test: mark test-worker-prof as flaky on smartos (Joyee Cheung) #56583d17bf2f62a] - test: update test-child-process-bad-stdio to use node:test (Colin Ihrig) #565625660b99b43] - test: disable openssl 3.4.0 incompatible tests (Jelle van der Waa) #56160861c99f351] - test: make test-crypto-hash compatible with OpenSSL > 3.4.0 (Jelle van der Waa) #56160597a39b5f9] - test: update error code in tls-psk-circuit for for OpenSSL 3.4 (sebastianas) #56420721e9e1217] - test: add initial test426 coverage (Chengzhong Wu) #56436cfe5380c44] - test: update test-set-http-max-http-headers to use node:test (Colin Ihrig) #5643951ff71a87a] - test: update test-child-process-windows-hide to use node:test (Colin Ihrig) #56437d6aca0cd89] - test: increase spin for eventloop test on s390 (Michael Dawson) #5622882461af6ec] - test: migrate message eval tests from Python to JS (Yiyun Lei) #504825083bbb2bb] - test: remove async-hooks/test-writewrap flaky designation (Luigi Pinca) #56048b4b26e973d] - test: deflake test-esm-loader-hooks-inspect-brk (Luigi Pinca) #56050182be26b8a] - test: update WPT for url to67880a4(Node.js GitHub Bot) #55999e67a84902f] - test_runner: remove unused errors (Pietro Marchini) #566074274c6a015] - test_runner: run single test file benchmark (Pietro Marchini) #56479e57004458b] - tools: update doc to new version (Node.js GitHub Bot) #56259e039f2b571] - tools: do not throw on missingcreate-release-proposal.sh(Antoine du Hamel) #567049a1e314498] - tools: fix tools-deps-update (Daniel Lemire) #56684d6469b5287] - tools: do not throw on missingcreate-release-proposal.sh(Antoine du Hamel) #56695e162476fdc] - tools: fix permissions inlint-release-proposalworkflow (Antoine du Hamel) #56614914b4675c8] - tools: editcreate-release-proposalworkflow (Antoine du Hamel) #565404ff9aa7235] - tools: validate commit list as part oflint-release-commit(Antoine du Hamel) #56291589d0ae8ea] - tools: fix loong64 build failed (Xiao-Tao) #56466bc8c39bff8] - tools: disable unneeded rule ignoring in Python linting (Rich Trott) #564293b130002bb] - tools: add release line label when opening release proposal (Antoine du Hamel) #5631773b5c16684] - (SEMVER-MINOR) worker: add postMessageToThread (Paolo Insogna) #53682v20.18.3: 2025-02-10, Version 20.18.3 'Iron' (LTS), @marco-ippolitoCompare Source
Notable Changes
030f155986] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #55333b9b006331f] - doc: add LJHarb to collaborators (Jordan Harband) #5613239b89e90b4] - doc: enforce strict policy to semver-major releases (Rafael Gonzaga) #55732247fa1959f] - crypto: update root certificates to NSS 3.104 (Richard Lau) #55681adfc2f993a] - tools: fix root certificate updater (Richard Lau) #5568129862ae105] - doc: add jazelly to collaborators (Jason Zhang) #55531Commits
b4f5da18a5] - benchmark: addtest-reporters(Aviv Keller) #55757407992e272] - benchmark: addtest_runner/mock-fn(Aviv Keller) #5577117abec4367] - benchmark: add nodeTiming.uvmetricsinfo bench (RafaelGSS) #5561443f7050338] - benchmark: add --runs support to run.js (Rafael Gonzaga) #55158470789a981] - benchmark: adjust byte size for buffer-copy (Rafael Gonzaga) #55295ea1c97ac16] - buffer: document concat zero-fill (Duncan) #55562ae683a9e1f] - build: set DESTCPU correctly for 'make binary' on loongarch64 (吴小白) #56271af020edf96] - build: fix missing fp16 dependency in d8 builds (Joyee Cheung) #56266d6a1b74404] - build: add major release action (Rafael Gonzaga) #56199bc92a96a5a] - build: allow overriding clang usage (Shelley Vohr) #56016f370ec0989] - build: remove defaults for create-release-proposal (Rafael Gonzaga) #5604225e1862e87] - build: set node_arch to target_cpu in GN (Shelley Vohr) #5596755c205e5f6] - build: add create release proposal action (Rafael Gonzaga) #556909f14ba808d] - build: implement node_use_amaro flag in GN build (Cheng) #55798046430c47e] - build: fix building with system icu 76 (Michael Cho) #555630b6d62c812] - build: fix GN arg used in generate_config_gypi.py (Shelley Vohr) #555308f9c642369] - build: fix GN build for cares/uv deps (Cheng) #55477284e932326] - build: fix uninstall script for AIX 7.1 (Cloorc) #554382f71f168ef] - build: tidy up cares.gyp (Richard Lau) #55445e89e807522] - build: synchronize list of c-ares source files (Richard Lau) #554455eb6c94851] - build: fix path concatenation (Mohammed Keyvanzadeh) #55387720d23f3ac] - build: fix make errors that occur in Makefile (minkyu_kim) #55287dc552c6739] - build,win: enable pch for clang-cl (Stefan Stojanovic) #5524964b140d484] - cli: add--heap-profflag available toNODE_OPTIONS(Juan José) #5425923fb644037] - crypto: ensure CryptoKey usages and algorithm are cached objects (Filip Skokan) #56108247fa1959f] - crypto: update root certificates to NSS 3.104 (Richard Lau) #556813c4262a171] - deps: V8: cherry-pick26fd1df(Shu-yu Guo) #55961558e6588a4] - deps: V8: backportae5a4db(Shu-yu Guo) #55961169bc58447] - deps: update simdutf to 5.6.4 (Node.js GitHub Bot) #56255bc7bb1e269] - deps: update c-ares to v1.34.4 (Node.js GitHub Bot) #56256782bb6cac4] - deps: update zlib to 1.3.0.1-motley-82a5fec (Node.js GitHub Bot) #55980f7131cf178] - deps: update corepack to 0.30.0 (Node.js GitHub Bot) #55977b09f6abcd3] - deps: update simdutf to 5.6.3 (Node.js GitHub Bot) #55973d63ccb60ea] - deps: update zlib to 1.3.0.1-motley-7e2e4d7 (Node.js GitHub Bot) #54432a2f315ef8b] - deps: update simdutf to 5.6.2 (Node.js GitHub Bot) #55889afed723b6c] - deps: update simdutf to 5.6.1 (Node.js GitHub Bot) #55850753c3b322f] - deps: update c-ares to v1.34.3 (Node.js GitHub Bot) #558034f89af8a6f] - deps: update acorn to 8.14.0 (Node.js GitHub Bot) #5569907359ec14f] - deps: update acorn to 8.13.0 (Node.js GitHub Bot) #55558c6236571fc] - deps: update googletest todf1544b(Node.js GitHub Bot) #55465f63413c6f3] - deps: update c-ares to v1.34.2 (Node.js GitHub Bot) #55463ad725c766d] - deps: update ada to 2.9.1 (Node.js GitHub Bot) #5467933367cbd62] - deps: update simdutf to 5.6.0 (Node.js GitHub Bot) #55379f2a55d9d2d] - deps: update c-ares to v1.34.1 (Node.js GitHub Bot) #553691d14886266] - dgram: check udp buffer size to avoid fd leak (theanarkh) #56084de265b9558] - diagnostics_channel: fix unsubscribe during publish (simon-id) #5511622e0d17097] - dns: stop using deprecatedares_query(Aviv Keller) #5543044f3b23749] - dns: honor the order option (Luigi Pinca) #55392f78508cd30] - doc: add history info for Permission Model (Antoine du Hamel) #56707f07be5e3cd] - doc: add note for features usingInternalWorkerwith permission model (Antoine du Hamel) #56706618e005672] - doc: add history entries for JSON modules stabilization (Antoine du Hamel) #55855f89f4ff856] - doc: fix color contrast issue in light mode (Rich Trott) #56272a51ef9d829] - doc: clarify util.aborted resource usage (Kunal Kumar) #557802d88c4b425] - doc: add esm examples to node:repl (Alfredo González) #55432722dada673] - doc: add esm examples to node:readline (Alfredo González) #55335090c7a3b01] - doc: fix 'which' to 'that' and add commas (Selveter Senitro) #56216ae3f6fbe59] - doc:sea.getRawAsset(key)always returns an ArrayBuffer (沈鸿飞) #56206d103917d92] - doc: update announce documentation for releases (Rafael Gonzaga) #5620080e5bb87c4] - doc: update blog link to /vulnerability (Rafael Gonzaga) #56198b739c2a926] - doc: call out import.meta is only supported in ES modules (Anton Kastritskii) #56186bbd0222a10] - doc: add ambassador message - benefits of Node.js (Michael Dawson) #560850e9abf2754] - doc: fix incorrect link to style guide (Yuan-Ming Hsu) #561811dbc7e87d7] - doc: fix c++ addon hello world sample (Edigleysson Silva (Edy)) #56172026f0198c8] - doc: update blog release-post link (Ruy Adorno) #56123c2fa359f7a] - doc: mention-aflag for the release script (Ruy Adorno) #56124b9b006331f] - doc: add LJHarb to collaborators (Jordan Harband) #561327a1365ba62] - doc: add create-release-action to process (Rafael Gonzaga) #5599351262ec84e] - doc: rename file to advocacy-ambassador-program.md (Tobias Nießen) #560466fc7328831] - doc: remove unused import from sample code (Blended Bram) #555709f3ef4a434] - doc: add FAQ to releases section (Rafael Gonzaga) #559921dcf8dfedb] - doc: move history entry to class description (Luigi Pinca) #55991e016f68c73] - doc: add history entry for textEncoder.encodeInto() (Luigi Pinca) #559901b31638262] - doc: improve GN build documentation a bit (Shelley Vohr) #55968d25bcfd0b2] - doc: remove confusing and outdated sentence (Luigi Pinca) #5598865c1784337] - doc: add doc for PerformanceObserver.takeRecords() (skyclouds2001) #55786682ae41f86] - doc: add vetted courses to the ambassador benefits (Matteo Collina) #559349b6cc54b50] - doc: doc how to add message for promotion (Michael Dawson) #55843db5378c8b9] - doc: add esm example for zlib (Leonardo Peixoto) #5594658a6fbb9cf] - doc: document approach for building wasm in deps (Michael Dawson) #5594041e3bcd752] - doc: add esm examples to node:timers (Alfredo González) #5585761de8f9b04] - doc: include git node release --promote to steps (Rafael Gonzaga) #55835559a0bfa2e] - doc: add a note on console stream behavior (Gireesh Punathil) #556163d11a85fe5] - doc: add-Sflag release preparation example (Antoine du Hamel) #55836955690e6cf] - doc: clarify UV_THREADPOOL_SIZE env var usage (Preveen P) #55832d6738e919a] - doc: add notable-change mention to sec release (Rafael Gonzaga) #5583079876f0dfd] - doc: fix history info forURL.prototype.toJSON(Antoine du Hamel) #55818c14776fbaa] - doc: correct max-semi-space-size statement (Joe Bowbeer) #5581283b415e8f3] - doc: run license-builder (github-actions[bot]) #5581307f53b1d75] - doc: clarify triager role (Gireesh Punathil) #557752abfdefcf3] - doc: clarify removal of experimental API does not require a deprecation (Antoine du Hamel) #5574639b89e90b4] - doc: enforce strict policy to semver-major releases (Rafael Gonzaga) #55732d0417eaec9] - doc: add esm example inpath.md(Aviv Keller) #55745032ff07a2d] - doc: consistent use of word child process (Gireesh Punathil) #5565416eef6461e] - doc: clarity to available addon options (Preveen P) #55715a7ce82e3cc] - doc: update--max-semi-space-sizedescription (Joe Bowbeer) #554951bb461e2b6] - doc: add write flag when open file as the demo code's intention (robberfree) #546268cd619f8d7] - doc: remove mention of ECDH-ES in crypto.diffieHellman (Filip Skokan) #556114576d14d0f] - doc: improve c++ embedder API doc (Gireesh Punathil) #5559712bd57fbaa] - doc: capitalize "MIT License" (Aviv Keller) #55575362b01b275] - doc: add esm examples to node:string_decoder (Alfredo González) #5550729862ae105] - doc: add jazelly to collaborators (Jason Zhang) #55531c1b63e5e6b] - doc: changed the command used to verify SHASUMS256 (adriancuadrado) #554209db657532b] - doc: add note about stdio streams in child_process (Ederin (Ed) Igharoro) #55322475e478713] - doc: addisBigIntObjectto documentation (leviscar) #554500487e70475] - doc: remove outdated remarks abouthighWaterMarkin fs (Ian Kerins) #55462e9a8feb44a] - doc: move Danielle Adams key to old gpg keys (RafaelGSS) #55399bfbe651626] - doc: move Bryan English key to old gpg keys (RafaelGSS) #55399c1cab9b4d7] - doc: move Beth Griggs keys to old gpg keys (RafaelGSS) #5539985d8eb397c] - doc: spell out condition restrictions (Jan Martin) #55187de8de542b5] - doc: add missing return values in buffer docs (Karl Horky) #55273a5df7087fd] - doc: fix ambasador markdown list (Rafael Gonzaga) #55361fbfcb0cc08] - doc: edit onboarding guide to clarify when mailmap addition is needed (Antoine du Hamel) #55334e70abce96a] - doc: fix the return type of outgoingMessage.setHeaders() (Jimmy Leung) #55290030f155986] - esm: mark import attributes and JSON module as stable (Nicolò Ribaudo) #5533386cb697b81] - esm: add a fallback when importer in not a file (Antoine du Hamel) #554718c8de30680] - esm: fix inconsistency withimportAssertioninresolvehook (Wei Zhu) #55365a41b0e1247] - events: optimize EventTarget.addEventListener (Robert Nagy) #553122c6dcf7209] - fs: make mutatingoptionsin Promisesreaddir()not affect results (LiviaMedeiros) #560579317feb829] - fs: lazily load ReadFileContext (Gürgün Dayıoğlu) #55998739ee18430] - http2: support ALPNCallback option (ZYSzys) #561877ba6dcf180] - http2: fix memory leak caused by premature listener removing (ywave620) #559664c15bd44a0] - http2: fix client async storage persistence (Orgad Shaneh) #55460ac57dadd9a] - lib: add validation for options in compileFunction (Taejin Kim) #56023a5b0d8900a] - lib: remove startsWith/endsWith primordials for char checks (Gürgün Dayıoğlu) #55407f10857828f] - lib: test_runner#mock:timers respeced timeout_max behaviour (BadKey) #553751a193bf256] - meta: bump github/codeql-action from 3.27.0 to 3.27.5 (dependabot[bot]) #5610323f319803d] - meta: bump actions/checkout from 4.1.7 to 4.2.2 (dependabot[bot]) #56102a953301a1c] - meta: bump step-security/harden-runner from 2.10.1 to 2.10.2 (dependabot[bot]) #56101c58065ae77] - meta: bump actions/setup-node from 4.0.3 to 4.1.0 (dependabot[bot]) #5610012b0cecc20] - meta: add releasers as CODEOWNERS to proposal action (Rafael Gonzaga) #56043070aa9d6a5] - meta: bump actions/setup-python from 5.2.0 to 5.3.0 (dependabot[bot]) #556887a46ffd18a] - meta: bump actions/setup-node from 4.0.4 to 4.1.0 (dependabot[bot]) #556878b4f2e0c6a] - meta: bump rtCamp/action-slack-notify from 2.3.0 to 2.3.2 (dependabot[bot]) #55686024c5b2ab3] - meta: bump actions/upload-artifact from 4.4.0 to 4.4.3 (dependabot[bot]) #556853d06971a15] - meta: bump actions/cache from 4.0.2 to 4.1.2 (dependabot[bot]) #55684c33de63a86] - meta: bump actions/checkout from 4.2.0 to 4.2.2 (dependabot[bot]) #55683ccc1ea0576] - meta: bump github/codeql-action from 3.26.10 to 3.27.0 (dependabot[bot]) #556829c2d0fd242] - meta: make review-wanted message minimal (Aviv Keller) #556070c14cae2b2] - meta: show PR/issue title on review-wanted (Aviv Keller) #55606aeae7e1e6f] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #553816d7b78c3d8] - meta: change color to blue notify review-wanted (Rafael Gonzaga) #554237441e289db] - meta: bump codecov/codecov-action from 4.5.0 to 4.6.0 (dependabot[bot]) #55222158c8ad77c] - meta: bump github/codeql-action from 3.26.6 to 3.26.10 (dependabot[bot]) #552218d3d4a9fab] - meta: bump step-security/harden-runner from 2.9.1 to 2.10.1 (dependabot[bot]) #552206797a35a5b] - module: prevent main thread exiting before esm worker ends (Shima Ryuhei) #56183bd99bf109f] - node-api: allow napi_delete_reference in finalizers (Chengzhong Wu) #556206308c18dbb] - report: fix network queries in getReport libuv with exclude-network (Adrien Foulon) #55602ff2eec7275] - sea: only assert snapshot main function for main threads (Joyee Cheung) #56120f9f3003de7] - src: fix outdated js2c.cc references (Chengzhong Wu) #56133a882536596] - src: fix kill signal on Windows (Hüseyin Açacak) #55514df1002438a] - src: improvenode:osuserInfo performance (Yagiz Nizipli) #55719f17416ec3e] - src: fix dns crash when failed to create NodeAresTask (theanarkh) #555218d5b8c31d8] - src: use NewFromUtf8Literal in NODE_DEFINE_CONSTANT (Charles Kerr) #555810977bb6c1d] - src: remove icu basedToASCIIandToUnicode(Yagiz Nizipli) #5515672817072e2] - src: fix winapi_strerror error string (Hüseyin Açacak) #552076f47f53f90] - src,lib: optimize nodeTiming.uvMetricsInfo (RafaelGSS) #55614ac583d4549] - stream: propagate AbortSignal reason (Marvin ROGER) #554731c8b474319] - test: skip test-buffer-tostring-range on smartos (Marco Ippolito) #5672739d608f9d8] - test: mark test-http-server-request-timeouts-mixed as flaky (Joyee Cheung) #565035c3f18be04] - test: temporary remove resource check from fs read-write (Rafael Gonzaga) #567894196aaf033] - test: remove exludes for sea tests on PPC (Michael Dawson) #562173ea738fc26] - test: removehasOpenSSL3xutils (Antoine du Hamel) #5616421e21a270e] - test: remove test-fs-utimes flaky designation (Luigi Pinca) #56052e464c6f7a5] - test: move test-worker-arraybuffer-zerofill to parallel (Luigi Pinca) #56053e99584cd57] - test: make HTTP/1.0 connection test more robust (Arne Keller) #559592d03f87ef7] - test: convert readdir test to use test runner (Thomas Chetwin) #55750207562fa3d] - test: make x509 crypto tests work with BoringSSL (Shelley Vohr) #55927a17d9e1acf] - test: fix determining lower priority (Livia Medeiros) #5590850b6729d8c] - test: increase coverage ofpathToFileURL(Antoine du Hamel) #554930aa9e74027] - test: improve test coverage for child process message sending (Juan José) #55710ebdbbc3ec8] - test: ensure that test priority is not higher than current priority (Livia Medeiros) #55739b40789e085] - test: add buffer to fs_permission tests (Rafael Gonzaga) #55734a9998799be] - test: improve test coverage forServerResponse(Juan José) #55711d2421f3c92] - test: ignore unrelated events in FW watch tests (Carlos Espa) #556050ac0afc4a9] - test: refactor some esm tests (Antoine du Hamel) #554720f8b8269d1] - test: split up test-runner-mock-timers test (Julian Gassner) #555068f6462f40b] - test: avoidapply()calls with large amount of elements (Livia Medeiros) #55501e9b0ff482b] - test: increase test coverage forhttp.OutgoingMessage.appendHeader()(Juan José) #55467d5ad060073] - test: fix addons and node-api test assumptions (Antoine du Hamel) #55441a28376bb85] - test: deflaketest-cluster-shared-handle-bind-privileged-port(Aviv Keller) #5537822c07867d1] - test: remove duplicate tests (Luigi Pinca) #553935489656b35] - test: update test_util.cc for coverage (minkyu_kim) #55291ceafb3250d] - test,crypto: make crypto tests work with BoringSSL (Shelley Vohr) #554917021b3b276] - test_runner: simplify hook running logic (Colin Ihrig) #55963d9fd632f56] - test_runner: error on mocking an already mocked date (Aviv Keller) #558583fcca16374] - test_runner: add support for scheduler.wait on mock timers (Erick Wendel) #55244f67147ec47] - tools: update github_reporter to 1.7.2 (Node.js GitHub Bot) #562055c819f1043] - tools: add REPLACEME check to workflow (Mert Can Altin) #56251b24a85b00b] - tools: usegithub.actorinstead of bot username for release proposals (Antoine du Hamel) #5623233cd7d3d8c] - tools: fix release proposal linter to support more than 1 folk preparing (Antoine du Hamel) #5620310d55e3d73] - tools: use commit title as PR title when creating release proposal (Antoine du Hamel) #56165b3d40e3be5] - tools: improve release proposal PR opening (Antoine du Hamel) #5616113455ca9ce] - tools: updatecreate-release-proposalworkflow (Antoine du Hamel) #56054851a3d7d8d] - tools: fix update-undici script (Michaël Zasso) #56069e1635fbd4e] - tools: allow dispatch oftools.ymlfrom forks (Antoine du Hamel) #560085f15d8b3f5] - tools: fix nghttp3 updater script (Antoine du Hamel) #56007bbf39b8c46] - tools: filter release keys to reduce interactivity (Antoine du Hamel) #55950954e60b87d] - tools: update WPT updater (Antoine du Hamel) #560031e09d258da] - tools: add WPT updater for specific subsystems (Mert Can Altin) #54460b95c4f5bf0] - tools: use tokenless Codecov uploads (Michaël Zasso) #559436327554706] - tools: add linter for release commit proposals (Antoine du Hamel) #55923aad478e58d] - tools: fix exclude labels for commit-queue (Richard Lau) #558091c8c881aef] - tools: make commit-queue check blocked label (Marco Ippolito) #55781c3913f9c87] - tools: fix c-ares updater script for Node.js 18 (Richard Lau) #55717adfc2f993a] - tools: fix root certificate updater (Richard Lau) #55681d336f8de15] - tools: compact jq output in daily-wpt-fyi.yml action (Filip Skokan) #55695cdb7839a0c] - tools: run daily WPT.fyi report on all supported releases (Filip Skokan) #55619274d0b4062] - tools: update lint-md-dependencies (Node.js GitHub Bot) #554703dceeb8b15] - tools: add script to synch c-ares source lists (Richard Lau) #55445bd0ec907da] - url: handle "unsafe" characters properly inpathToFileURL(Antoine du Hamel) #5454583137bceb6] - util: fix Latin1 decoding to return string output (Mert Can Altin) #56222195cc42935] - util: do not rely on mutableObjectandFunction'constructorprop (Antoine du Hamel) #56188cca7c518de] - util: add fast path for Latin1 decoding (Mert Can Altin) #552757ed346d8fd] - util: do not catch on circular@@​toStringTagerrors (Aviv Keller) #55544aa031b3eec] - worker: fix crash when a worker joins after exit (Stephen Belanger) #56191v20.18.2: 2025-01-21, Version 20.18.2 'Iron' (LTS), @RafaelGSSCompare Source
This is a security release.
Notable Changes
Dependency update:
Commits
df8b9f2c3e] - (CVE-2025-22150) deps: update undici to v6.21.1 (Matteo Collina) nodejs-private/node-private#66342d5821873] - (CVE-2025-23084) path: fix path traversal in normalize() on Windows (Tobias Nießen) nodejs-private/node-private#5558187a4b9bb] - src: fix HTTP2 mem leak on premature close and ERR_PROTO (RafaelGSS)389f239a28] - (CVE-2025-23083) src,loader,permission: throw on InternalWorker use (RafaelGSS) nodejs-private/node-private#652Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by Renovate Bot.
f3b3a3114ato7922d096217922d09621toe76b20f7b8e76b20f7b8tob808d3597ab808d3597ato157c851230157c851230to695201d683chore(deps): update node.js to v20.18.2to chore(deps): update node.js to v20.18.3695201d683to2f569b211f2f569b211fto529e2691a0529e2691a0to7abe3470e17abe3470e1tob3b9de6dceb3b9de6dcetof796081996chore(deps): update node.js to v20.18.3to chore(deps): update node.js to v20.19.0f796081996toc4796e0d2cCheckout
From your project repository, check out a new branch and test the changes.